TITLE 1.82. BUSINESS RECORDS [1799 - 1799.3]

CHAPTER 2. Disclosures [1799.1 - 1799.1b]

(a) No business entity which performs bookkeeping services shall disclose in whole or in part the contents of any record, including the disclosure of information in the record in any composite of information, which is prepared or maintained by such business entity to any person, other than the individual or business entity which is the subject of the record, without the express written consent of such individual or business entity.

(b) This section shall not apply to the following:

(1) To a disclosure to any person pursuant to a subpoena or court order.

(2) To a disclosure which is discoverable.

(3) To a disclosure to any person acting pursuant to a lawful search warrant.

(4) To a disclosure to a law enforcement agency when required for investigations of criminal activity, unless such disclosure is prohibited by law.

(5) To a disclosure to a taxing agency for purposes of tax administration.

(a) No person, including an individual, firm, corporation, association, partnership, or joint venture, or any employee or agent thereof, shall disclose information obtained from a federal or state income tax return or any information obtained from a tax schedule submitted with the return by a consumer in connection with a financial or other business-related transaction unless the disclosure is within any of the following:

(1) Consented to in writing by the consumer in a separate document that states to whom the disclosure will be made and how the information will be used. If the consumer agrees, this separate consent document may be in the form of an electronic record, executed by an electronic signature as provided by Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code.

(2) Authorized or required by state or federal law.

(3) Necessary to complete or service the financial or business-related transaction or to effect, administer, or enforce a financial or business-related transaction requested by the consumer.

(4) Pursuant to court order.

(5) Required to complete any of the transactions described in subparagraphs (A) to (D), inclusive, by a person, including an individual, firm, corporation, association, partnership or joint venture, if the disclosure is made solely for that purpose. The provisions of this section apply to any person, including an individual, firm, corporation, association, partnership, or joint venture, and any employee or agent thereof, receiving information as a result of a disclosure authorized by this paragraph.

(A) A proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit.

(B) A proposed or actual securitization or secondary market sale, including the sale of servicing rights.

(D) To protect against or to prevent actual or potential fraud and unauthorized transactions and claims and for institutional risk control activities.

(b) No unrelated use shall be made of a federal or state tax return or any information obtained therefrom or any information submitted with the return by a consumer in connection with a financial or other business-related transaction. “Unrelated use” means any use that is not necessary to effect, administer, or enforce the financial or other business-related transaction with the consumer or that is beyond the scope of the stated purpose to which the consumer consented for the use of the return or any other information he or she submitted.

(c) (1) For purposes of this section, the following definitions shall apply:

(A) “Affiliate” means any entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, another entity.

(B) “Consumer” means an individual who requests or obtains financial or other business-related services.

(C) “Tax return” means a return, declaration, statement, refund claim, or other document required to be made or to be filed in connection with state or federal income taxes or state bank and corporation franchise taxes.

(2) A disclosure prohibited by this section includes a disclosure made internally within the entity or by that entity to any of its subsidiaries or affiliates.

(3) The information described in subdivision (a) includes that information obtained through an electronic medium.

(d) No person, including an individual, firm, corporation, association, partnership, or joint venture, or any employee or agent thereof, shall dispose of any of the information described in subdivision (a) in a manner in which the identity of the consumer may be determined from the disposed information alone or in combination with other publicly available information. This subdivision shall not become operative if Assembly Bill 2246 of the 1999–2000 Regular Session is enacted and becomes effective on or before January 1, 2001.

(e) The civil remedies in Chapter 3 (commencing with Section 1799.2) shall be applicable to a violation of this section. Each violation of this section shall constitute a separate cause of action for which damages are recoverable.

(f) The treatment of tax returns by tax preparers, as defined in Section 22251 of the Business and Professions Code, shall be governed by Section 17530.5 of the Business and Professions Code.

(a) Any credit card issuer that receives a change of address request, other than for a correction of a typographical error, from a cardholder who orders a replacement credit card within 60 days before or after that request is received shall send to that cardholder a change of address notification that is addressed to the cardholder at the cardholder’s previous address of record. If the replacement credit card is requested prior to the effective date of the change of address, the notification shall be sent within 30 days of the change of address request. If the replacement credit card is requested after the effective date of the change of address, the notification shall be sent within 30 days of the request for the replacement credit card.

(b) Any business entity that provides telephone accounts that receives a change of address request, other than for a correction of a typographical error, from an accountholder who orders new service, shall send to that accountholder a change of address notification that is addressed to the accountholder at the accountholder’s previous address of record. The notification shall be sent within 30 days of the request for new service.

(c) The notice required pursuant to subdivision (a) or (b) may be given by telephone or e-mail communication if the credit card issuer or business entity that provides telephone accounts reasonably believes that it has the current telephone number or e-mail address for the accountholder or cardholder who has requested a change of address. If the notification is in writing it may not contain the consumer’s account number, social security number, or other personal identifying information, but may contain the consumer’s name, previous address, and new address of record. For business entities described in subdivision (b), the notification may also contain the accountholder’s telephone number.

(d) A credit card issuer or a business entity that provides telephone accounts is not required to send a change of address notification when a change of address request is made in person by a consumer who has presented valid identification, or is made by telephone and the requester has provided a unique alpha-numeric password.

(e) The following definitions shall apply to this section:

(1) “Credit account” has the same meaning as “credit card,” as defined in subdivision (a) of Section 1747.02.

(2) “Telephone account” means an account with a telephone corporation, as defined in Section 234 of the Public Utilities Code.